magika
google/magikaFast and accurate AI powered file content types detection
code-analysisforensicsgeneral-purpose-utilities+3
google/magikaFast and accurate AI powered file content types detection
liverwortenuresis371/copyfail-rsExploit and detect CVE-2026-31431 vulnerabilities using a static binary that monitors system integrity and bypasses PAM authentication.
last-emo-boy/rikuneMCP server for reverse engineering Windows executables and binary formats. Combines static triage, Ghidra-assisted function recovery, plugin-driven…
mo200909/office-malware-forensics-lab-remnux-static-analysisStatic analysis of 2 malicious Office documents on REMnux using oletools; identified CVE-2017-11882 and obfuscated macros.
rhacknarok/hacksguardA blazingly fast, multi-threaded TUI malware analysis tool built in Rust. Features deep PE parsing, YARA scanning, and heuristic risk scoring.
zypherion-technologies/unconfuserexA ConfuserEx2 deobfuscator with support for anti tamper, compressor, constants, control flow, and resource recovery.
warpedatom/offsetinspectPowerShell toolkit for AMSI/Defender detection-boundary analysis and static malware triage maps byte offsets to detection triggers, plus YARA,…
opensourcemalware/polinriderTechnical dossier on the DPRK-linked PolinRider supply-chain attack, documenting obfuscated JS payload injection, git history manipulation, C2…
struppigel/hedgehog-toolsCollection of scripts for malware analysis, deobfuscation, and configuration extraction. Supports static analysis, unpacking, shellcode conversion,…
respondiq/jsp-webshell-scanner🔍 A simple Bash script to detect malicious JSP webshells, including those used in exploits of SAP NetWeaver CVE-2025-31324.
afine-com/glassworm-hunterDetects GlassWorm supply chain attack payloads by scanning VS Code extensions, npm/PyPI packages, and git repos for invisible Unicode payloads,…
ernos/browser-xpi-malware-scannerA comprehensive browser extension (.xpi) malware scanner which checks for many common malware tricks like:, credential-stealers obfuscation tactics,…
darksp33d/hyperhives-macos-infostealer-analysisFull static analysis of HyperHives macOS Rust infostealer — 571 decrypted config values, C2 infrastructure, DPRK/Contagious Interview attribution,…
landw-hub/cve-2025-50422Proof-of-concept for CVE-2025-50422: demonstrates heap memory disclosure in Poppler's pdftocairo, allowing local attackers to recover clear-text PDF…
struppigel/portexJava library to analyse Portable Executable files with a special focus on malware analysis and PE malformation robustness
prophetcraft/jarhunterJAR analysis tool for exploring, searching, and extracting specific classes from large JAR files with bytecode search, multi-selection extraction,…
blakebratcher/wcw-cyberring-pav-decryptorCryptanalysis of a proprietary 1999 video DRM system. Recovers 61 encrypted wrestling videos from the WCW Internet Powerdisk CD-ROM through static…